Computer intrusion detection through EWMA for autocorrelated and uncorrelated data

Nong Ye, Sean Vilbert, Qiang Chen

Research output: Contribution to journalArticle

102 Citations (Scopus)

Abstract

Reliability and quality of service from information systems has been threatened by cyber intrusions. To protect information systems from intrusions and thus assure reliability and quality of service, it is highly desirable to develop techniques that detect intrusions. Many intrusions manifest in anomalous changes in intensity of events occurring in information systems. In this study, we apply, test, and compare two EWMA techniques to detect anomalous changes in event intensity for intrusion detection: EWMA for autocorrelated data and EWMA for uncorrelated data. Different parameter settings and their effects on performance of these EWMA techniques are also investigated to provide guidelines for practical use of these techniques.

Original languageEnglish (US)
Pages (from-to)75-82
Number of pages8
JournalIEEE Transactions on Reliability
Volume52
Issue number1
DOIs
StatePublished - Mar 2003

Fingerprint

Intrusion detection
Information systems
Quality of service

Keywords

  • Anomaly detection
  • Computer audit data
  • Exponentially weighted moving average (EWMA)
  • Information assurance
  • Intrusion detection

ASJC Scopus subject areas

  • Computer Graphics and Computer-Aided Design
  • Hardware and Architecture
  • Software
  • Electrical and Electronic Engineering
  • Safety, Risk, Reliability and Quality

Cite this

Computer intrusion detection through EWMA for autocorrelated and uncorrelated data. / Ye, Nong; Vilbert, Sean; Chen, Qiang.

In: IEEE Transactions on Reliability, Vol. 52, No. 1, 03.2003, p. 75-82.

Research output: Contribution to journalArticle

@article{d79c747db7e7401cab4539d9ea347d59,
title = "Computer intrusion detection through EWMA for autocorrelated and uncorrelated data",
abstract = "Reliability and quality of service from information systems has been threatened by cyber intrusions. To protect information systems from intrusions and thus assure reliability and quality of service, it is highly desirable to develop techniques that detect intrusions. Many intrusions manifest in anomalous changes in intensity of events occurring in information systems. In this study, we apply, test, and compare two EWMA techniques to detect anomalous changes in event intensity for intrusion detection: EWMA for autocorrelated data and EWMA for uncorrelated data. Different parameter settings and their effects on performance of these EWMA techniques are also investigated to provide guidelines for practical use of these techniques.",
keywords = "Anomaly detection, Computer audit data, Exponentially weighted moving average (EWMA), Information assurance, Intrusion detection",
author = "Nong Ye and Sean Vilbert and Qiang Chen",
year = "2003",
month = "3",
doi = "10.1109/TR.2002.805796",
language = "English (US)",
volume = "52",
pages = "75--82",
journal = "IEEE Transactions on Reliability",
issn = "0018-9529",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
number = "1",

}

TY - JOUR

T1 - Computer intrusion detection through EWMA for autocorrelated and uncorrelated data

AU - Ye, Nong

AU - Vilbert, Sean

AU - Chen, Qiang

PY - 2003/3

Y1 - 2003/3

N2 - Reliability and quality of service from information systems has been threatened by cyber intrusions. To protect information systems from intrusions and thus assure reliability and quality of service, it is highly desirable to develop techniques that detect intrusions. Many intrusions manifest in anomalous changes in intensity of events occurring in information systems. In this study, we apply, test, and compare two EWMA techniques to detect anomalous changes in event intensity for intrusion detection: EWMA for autocorrelated data and EWMA for uncorrelated data. Different parameter settings and their effects on performance of these EWMA techniques are also investigated to provide guidelines for practical use of these techniques.

AB - Reliability and quality of service from information systems has been threatened by cyber intrusions. To protect information systems from intrusions and thus assure reliability and quality of service, it is highly desirable to develop techniques that detect intrusions. Many intrusions manifest in anomalous changes in intensity of events occurring in information systems. In this study, we apply, test, and compare two EWMA techniques to detect anomalous changes in event intensity for intrusion detection: EWMA for autocorrelated data and EWMA for uncorrelated data. Different parameter settings and their effects on performance of these EWMA techniques are also investigated to provide guidelines for practical use of these techniques.

KW - Anomaly detection

KW - Computer audit data

KW - Exponentially weighted moving average (EWMA)

KW - Information assurance

KW - Intrusion detection

UR - http://www.scopus.com/inward/record.url?scp=0037333205&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=0037333205&partnerID=8YFLogxK

U2 - 10.1109/TR.2002.805796

DO - 10.1109/TR.2002.805796

M3 - Article

AN - SCOPUS:0037333205

VL - 52

SP - 75

EP - 82

JO - IEEE Transactions on Reliability

JF - IEEE Transactions on Reliability

SN - 0018-9529

IS - 1

ER -